fix: added missing vault-author-fix file, removed old auth UI and unused middleware

Author: Aarushi Keshari

backend/app.py

@@ -72,7 +72,7 @@
     validate_jwt_secret,
     is_production_mode
 )
-from middleware import require_strong_password  # Issue #790
+
 from collections import defaultdict, deque
 from math import ceil
 from time import time
@@ -1487,7 +1487,7 @@ def sync_library():
 # =========================================================================
 @app.route('/api/v1/register', methods=['POST'])
 @limiter.limit("5 per minute")
-@require_strong_password
+
 def register():
     """Register a new user and return JWT token."""
     try:

backend/middleware.py

@@ -12,11 +12,10 @@
         DEFAULT_ALLOWED_CONTENT_TYPES,
         validate_content_type as _validate_content_type_header,
     )
-    from .validators import validate_password_strength
 except ImportError:
     from error_responses import invalid_json_error
     from security_parsers import DEFAULT_ALLOWED_CONTENT_TYPES, validate_content_type as _validate_content_type_header
-    from validators import validate_password_strength
+   
 
 logger = logging.getLogger(__name__)
 
@@ -181,80 +180,6 @@ def decorated_function(*args, **kwargs):
     return decorator
 
 
-# ─────────────────────────────────────────────────────────────────────────────
-# PASSWORD STRENGTH ENFORCEMENT  (Issue #790)
-# ─────────────────────────────────────────────────────────────────────────────
-
-def require_strong_password(f):
-    """
-    Decorator that enforces strong password policy on any endpoint that
-    receives a 'password' field in its JSON body (e.g. /api/v1/register).
-
-    This acts as a second layer of defence — RegisterRequest in validators.py
-    already runs the same check via Pydantic.  Having it here means the rule
-    is enforced even if the route is called without the Pydantic schema, and
-    it returns a consistent, descriptive 400 response before any business
-    logic runs.
-
-    Usage:
-        @app.route('/api/v1/register', methods=['POST'])
-        @require_strong_password
-        def register():
-            ...
-
-    Response on failure (HTTP 400):
-        {
-            "success": false,
-            "error": "Password does not meet security requirements",
-            "requirements": [
-                "Minimum 8 characters required",
-                "At least one uppercase letter (A–Z) required"
-            ]
-        }
-    """
-    @wraps(f)
-    def decorated_function(*args, **kwargs):
-        # Only check POST / PUT / PATCH — skip GET, HEAD, DELETE
-        if request.method not in ('POST', 'PUT', 'PATCH'):
-            return f(*args, **kwargs)
-
-        data = request.get_json(silent=True) or {}
-        password = data.get('password', '')
-
-        if not password:
-            logger.warning(
-                f"[require_strong_password] Missing password field "
-                f"on {request.method} {request.path} from {request.remote_addr}"
-            )
-            return jsonify({
-                'success': False,
-                'error': 'Password is required',
-                'requirements': []
-            }), 400
-
-        is_valid, errors = validate_password_strength(password)
-
-        if not is_valid:
-            logger.warning(
-                f"[require_strong_password] Weak password rejected "
-                f"on {request.path} from {request.remote_addr} — "
-                f"failed rules: {errors}"
-            )
-            return jsonify({
-                'success': False,
-                'error': 'Password does not meet security requirements',
-                'requirements': errors
-            }), 400
-
-        return f(*args, **kwargs)
-
-    return decorated_function
-
-# ─────────────────────────────────────────────────────────────────────────────
-# END PASSWORD STRENGTH ENFORCEMENT
-# ─────────────────────────────────────────────────────────────────────────────
-
-
 def csrf_token_required(f):
     """
     =============================================================================

frontend/js/vault-author-fix.js

@@ -0,0 +1,5 @@
+document.addEventListener('DOMContentLoaded', () => {
+    document.querySelectorAll('.vault-author, [data-author]').forEach(el => {
+        if (el.textContent) el.textContent = el.textContent.trim();
+    });
+});

frontend/pages/auth.html

@@ -424,31 +424,20 @@ <h2 id="authTitle">Welcome Back</h2>
                         <i class="fa-solid fa-eye password-toggle-icon" id="togglePassword" title="Show Password"
                             aria-label="Show password" role="button" tabindex="0"></i>
                     </div>
+
+                    <!-- PASSWORD STRENGTH UI -->
                     <div class="password-strength-bar">
-  <div id="strength-fill" class="strength-fill"></div>
-</div>
-
-<p id="strength-label" class="strength-label"></p>
-
-<ul class="pw-checklist" id="pw-checklist">
-  <li id="chk-len">At least 8 characters</li>
-  <li id="chk-up">One uppercase letter</li>
-  <li id="chk-low">One lowercase letter</li>
-  <li id="chk-num">One digit (0–9)</li>
-  <li id="chk-spec">One special character</li>
-</ul>
-
-                    <!-- 
-                        =============================================================
-                        SECURITY COMPLIANCE: CSRF TOKEN FIELD
-                        =============================================================
-                        This hidden input is dynamically populated with a one-time 
-                        security token provided by the backend. It protects against
-                        Cross-Site Request Forgery attacks by ensuring that the 
-                        form submission originated from this specific application 
-                        instance.
-                        =============================================================
-                    -->
+                        <div id="strength-fill" class="strength-fill"></div>
+                    </div>
+                    <p id="strength-label" class="strength-label"></p>
+                    <ul class="pw-checklist" id="pw-checklist">
+                        <li id="chk-len">At least 8 characters</li>
+                        <li id="chk-up">One uppercase letter</li>
+                        <li id="chk-low">One lowercase letter</li>
+                        <li id="chk-num">One digit (0–9)</li>
+                        <li id="chk-spec">One special character</li>
+                    </ul>
+
                     <input type="hidden" id="csrf_token" name="csrf_token" value="">
 
                     <!-- Primary Action Button -->
@@ -524,7 +513,6 @@ <h3 style="color: var(--text-main) !important;">Ambient Sanctuary</h3>
     </div>
   </div>
 
-
     <script src="../js/config.js"></script>
     <script src="../js/footer.js"></script>
     <script src="../js/app.js"></script>
@@ -601,18 +589,8 @@ <h3 style="color: var(--text-main) !important;">Ambient Sanctuary</h3>
     </script>
     <script src="../js/pwa.js"></script>
     <script>
-        /**
-         * ==============================================================================
-         * CSRF INITIALIZATION LOGIC
-         * ==============================================================================
-         * On document load, we query the backend's CSRF endpoint to retrieve a 
-         * fresh security token. This token is then stored in the hidden form 
-         * field and utilized in the 'handleAuth' submission headers.
-         * ==============================================================================
-         */
         document.addEventListener('DOMContentLoaded', async () => {
             try {
-                // We use MOOD_API_BASE from config.js
                 const response = await fetch(`${MOOD_API_BASE}/csrf-token`, {
                     method: 'GET',
                     credentials: 'include'